CVE-2026-98242 in Linux
Summary
by MITRE • 10/06/2026
In the Linux kernel, the following vulnerability has been resolved:
dma-buf: Fix silent overflow for phys vec to sgt
In case MMIO size is bigger than 4G and peer2peer DMA goes through host bridge, we trigger a code path that assigns the total linked IOVA (which is greater than 4G) to mapped_len.
Previously, `mapped_len` was declared as 32-bit `unsigned int`. When accumulating `size_t` lengths, this leads to a silent wrap-around. This truncation causes truncated lengths to be passed to functions like `fill_sg_entry()`.
Fix this by changing `mapped_len` to `size_t` (64-bit). While at it, fix similar potential overflow issues in `calc_sg_nents` by using `check_add_overflow()` for `nents` and using `unsigned int` for the loop iterator in `fill_sg_entry` to match.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified within the Linux kernel's dma-buf subsystem represents a critical integer overflow issue that arises during peer-to-peer direct memory access operations involving large memory mappings. Specifically, this flaw occurs when the Memory-Mapped Input/Output size exceeds four gigabytes and the data transfer is routed through the host bridge. In such scenarios, the system accumulates total linked IOVA addresses which can surpass the 32-bit address space limit. The core technical defect lies in the declaration of the variable mapped_len as a thirty-two-bit unsigned integer. When this variable is used to accumulate size_t lengths derived from potentially large memory regions, it fails to accommodate values exceeding four gigabytes, resulting in a silent wrap-around or truncation error rather than an explicit overflow exception.
This truncation has severe operational implications for system stability and data integrity. The truncated length value is subsequently passed to low-level functions such as fill_sg_entry which rely on accurate size information to populate scatter-gather list entries correctly. Because the length field contains incorrect, wrapped-around values, subsequent memory operations may access unintended physical or virtual addresses. This can lead to buffer overflows in downstream processing logic, potential data corruption of DMA buffers, and unpredictable kernel behavior including crashes or hangs. The issue is particularly dangerous because it occurs silently without triggering standard bounds checking mechanisms that might otherwise alert administrators or developers to the anomaly until a failure manifests at runtime.
From a vulnerability classification perspective, this flaw aligns with CWE-190 Integer Overflow or Wraparound, as the arithmetic operation exceeds the maximum value representable by the data type used for storage. Furthermore, it relates to CWE-787 Out-of-bounds Write if the truncated length causes writes beyond allocated buffer boundaries during scatter-gather list population. In terms of adversarial tactics, this vulnerability could be leveraged within ATT&CK technique T1059 Command and Scripting Interpreter or T1203 Exploitation for Client Execution if an attacker can trigger specific DMA operations to cause a kernel panic leading to denial of service, or potentially escalate privileges by corrupting kernel memory structures through the malformed scatter-gather entries.
The remediation strategy implemented in this fix involves changing the data type of mapped_len from unsigned int to size_t, which is typically sixty-four bits on modern architectures and capable of holding values well beyond four gigabytes without overflow. Additionally, similar potential overflow issues within calc_sg_nents were addressed by implementing check_add_overflow checks for nents calculations to ensure that arithmetic operations are validated before assignment. The loop iterator in fill_sg_entry was also adjusted to use unsigned int where appropriate to maintain consistency and prevent further type mismatch errors during iteration over scatter-gather entries. These changes collectively enforce stricter bounds checking and utilize appropriately sized data types to handle large memory mappings safely, thereby eliminating the silent truncation vector that previously allowed for potential exploitation through DMA buffer manipulation.